The NAT/Firewall Problem! And the benefits of our cure… Prepared for:Summer VON Europe 2003 SIP Forum By: Karl Erik Ståhl President Intertex Data AB Chairman Ingate Systems AB © 2003 Intertex Data AB 1

Everyone has a connection IP Phone PSTN SIP /PSTN Gateway IP SOHO LAN Business LAN SIP Server IAP XP PIM Firewall/NAT problems! DSL Cable MTU Operator network with NAT NAT Firewall NAT What is the Problem?? SIP is the Protocol for IP Communication Person to Person, BUT IT DOES NOT REACH THE EDGE! SIP does not traverse common NATs and Firewalls! And they are still being installed…

© 2003 Ingate Systems AB © 2003 Intertex Data AB 3 What is the difference? Typical Internet protocol (SMTP, HTTP…) Internet HOST SERVER SIP (and H.323…) connects person to person Internet PERSON Locate the person - Set up a session - Open real time media streams

© 2003 Ingate Systems AB © 2003 Intertex Data AB 4 SIP Firewall Problems Sessions initiated from outside the firewall - OK, open port 5060, but… Media streams on dynamically allocated port numbers - Ooops…  ! Even with public IP addresses inside Firewall Problems:

© 2003 Ingate Systems AB © 2003 Intertex Data AB 5 SIP NAT/PAT Problems Where is the device? - Registration/location function Private IP addresses and ports in SIP messages - Rewrite with globally routable addresses IP address and port of media stream has to be modified - NAT engine has to be dynamically controlled Worse with private IP addresses inside NAT & PAT Problems:

© 2003 Ingate Systems AB © 2003 Intertex Data AB 6 Suggested Solutions Dynamically controlled Firewall/NATs Midcom: By Firewall Control Proxy UPnP: By the client (Windows) SIP aware Firewall/NATs (SIP Proxy + Registrar) General, handles complex scenarios [Intertex (SOHO), Ingate (enterprise), …] SIP aware Firewall/NATs (SIP ALG – non Proxy) TLS not possible STUN - Can cope with certain types existing NATs SIP clients need to get STUN into their SIP stacks Requires STUN servers on the net Tunnelling - Brings the SIP-client to an operator or a corporate LAN Requires ALG for each client on LAN with own address space IPSec, Proprietary

© 2003 Ingate Systems AB © 2003 Intertex Data AB 7 Internet IP Real and Complex Scenarios SIP /PSTN Gateway Complications:  Tight firewalls?  Call transfer?  SIP server on the LAN?  Trusted connections, TLS? XP SIP Server 2 SIP Server 3 SIP Server 4 LAN Firewall/NAT IP Phone SIP TLS Sooner or later: The NAT/Firewall problem needs to be solved where it occurs!

© 2003 Ingate Systems AB © 2003 Intertex Data AB 8 Adding General SIP Traversal to a Firewall Important components: Firewall & NAT Dynamic Firewall Engine SIP Proxy SIP Proxy Server, controlling the firewall User Location SIP Registrar, user location information Firewall Control Protocol Communication between SIP Proxy and firewall In the Ingate and Intertex products: You got a SIP server! Use it just for firewall traversal AND/OR as your - SIP Server - Outbound proxy - Inbound proxy What have you got?

Firewall/NAT problems! Firewall/NAT SIP transparency! Office or home LAN IP Phone SIP Server PSTN SIP /PSTN Gateway Operator network with NAT Internet NAT Firewall NAT Enterprise LAN DSL Cable MTU DMZ inGate SIParator SIP Enabling the Private Networks inGate Firewall IP Phone IX66 IAP

Internet Just Another Internet Service… PSTN SIP /PSTN Gateway DNS SRV DMZ inGate SIParator XP Ingate Linköping LAN IX66 Intertex Stockholm LAN Sweden IX66 FWD Booth #3 USA Sweden IX66 Home Office Users SOHO LAN IX66 XP London Booth #1 Enterprise LAN XP inGate Firewall Booth #2

IP Communications Using IP Networks Intranet IP VPN with IP communications Domestic and global IP communications PBX and PSTN – E.164 resolution Customer Premises PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Many call routing options: Private/Public IP address DNS and DNS SRV records SIP aware NAT/PAT servers Henry Sinnreich 4/10/2002 WorldCom Public IP Network

IP Communications Using IP Networks PBX PSTN Phone Managed Services Router Vmail OSS SIP Phone WorldCom PSTN Dialing Plans Network GWY Conf PSTN Phone IM IN Enterprise Gateway SIP Routing Firewall SIP Server IP VPN Global IP Comm Intranet IP Comm …other… Integration with existing phones SIP Capable Firewall Ingate and Intertex First through SIT Customer Premises No IP PBX Needed! Enhanced Functionality Enterprise LAN WorldCom Public IP Network

Firewall Presence IM Greenwich Edge Proxy DMZ Microsoft Greenwich Home Server: Presence IM Audio Video Data Col. TLS

© 2003 Ingate Systems AB © 2003 Intertex Data AB 14 Mixed Environments SIP capable firewalls make the difference!

© 2003 Ingate Systems AB © 2003 Intertex Data AB 15 Product Examples – Ingate Systems AB Complete Firewalls Add-on to Existing Firewalls  Firewall & NAT/PAT  SIP Proxy  SIP Registrar Enterprise Products DMZ Existing Firewall SIParator

© 2003 Ingate Systems AB © 2003 Intertex Data AB 16 Product Examples – Intertex Data AB IX66 Internet Gate with or without ADSL modem built-in OEM as: Telia SurfinBird Gate PowerBit SafeGate Review at: SOHO Products

© 2003 Ingate Systems AB © 2003 Intertex Data AB 17 The Intertex IX66 Internet Gate A closer look  Firewall & NAT/PAT Router  SIP Proxy and Registrar  DHCP Server and Client  WEB Server for configuration  Smart Card Reader for security applications  Optional b Wireless Lan  SIP Appliance Control, LAC via expansion port Optional ADSL and Splitter Built-in

© 2003 Ingate Systems AB © 2003 Intertex Data AB 18 SIP Capable Firewalls! Ingate Systems AB Box 10013, Slakthusplan 4 SE Stockholm, Sweden CEO Olle Westerberg Tel Intertex Data AB Rissneleden 45 SE Sundbyberg, Sweden President Karl Erik Ståhl Tel See us in booth 1 & 2!